Facebook's Beacon More Intrusive Than Previously Thought
A Computer Associates security researcher says that Facebook's controversial Beacon online ad system goes much further than expected in tracking people's Web activities.
http://www.pcworld.com/article/id,140182-c,onlineprivacy/article.htmlA Computer Associates security researcher is sounding the alarm that Facebook's controversial Beacon online ad system goes much further than anyone has imagined in tracking people's Web activities outside the popular social networking site. Beacon will report back to Facebook on members' activities on third-party sites that participate in Beacon even if the users are logged off from Facebook and have declined having their activities broadcast to their Facebook friends. That's the finding published on Friday by Stefan Berteau, senior research engineer at CA's Threat Research Group in a note summarizing tests he conducted. Of particular concern is that users aren't informed that data on their activities at these sites is flowing back to Facebook, nor given the option to block that information from being transmitted, Berteau said in an interview. "It can happen completely without their knowledge, unless they are examining their network traffic at a very low level," Berteau said.
Off-Facebook activities that can be broadcast to one's Facebook friends include purchasing a product, signing up for a service and including an item on a wish list. But Berteau's investigation reveals that Beacon is more intrusive and stealthy than anyone had imagined. In his note, titled "Facebook's Misrepresentation of Beacon's Threat to Privacy: Tracking users who opt out or are not logged in," he explains that he created an account on Conde Nast's food site Epicurious.com, a site participating in Beacon, and saved three recipes as favorites. He saved the first recipe while logged in to Facebook, and he opted out of having it broadcast to his friends on Facebook. He saved the second recipe after closing the Facebook window, but without logging off from Epicurious or ending the browser session, and again declined broadcasting it to his friends. Then he logged out of Facebook and saved the third recipe. This time, no Facebook alert appeared asking if he wanted the information displayed to his friends.
After checking his network traffic logs, Berteau saw that in all three cases, information about his activities was reported back to Facebook, although not to his friends. That information included where he was on Epicurious, the action he had just taken and his Facebook account name. "The first two cases involve the transmission of user data despite 'No thanks' having been selected on the opt-out dialog, and are causes for deep concern. They pale, however, in comparison to the third case, where Facebook was receiving data about my online habits while I was not logged in, and was doing so silently, without even alerting me to the cross-site communication," he wrote in the research note.
If a user has ever checked the option for Facebook to "remember me" -- which saves the user from having to log on to the site upon every return to it -- Facebook can tie his activities on third-party Beacon sites directly to him, even if he's logged off and has opted out of the broadcast. If he has never chosen this option, the information still flows back to Facebook, although without it being tied to his Facebook ID, according to Berteau. Berteau wasn't able to determine where this data flows to in Facebook. "That's part of the concern here," he said in the interview. He repeated the Epicurious experiment with Kongregate.com, another Beacon-affiliated site, and got similar results. In e-mail correspondence with Facebook's privacy department, Berteau was told, among other things, that "as long as you are logged out of Facebook, no actions you have taken on other websites can be sent to Facebook."
Printer-friendly format
Email this thread to a friend
Bookmark this thread
(1000+ posts)
Send PM |
Profile |
Ignore
